In which of the following folders are memory versions of hives stored when a computer shuts down?

Skip to main content

This browser is no longer supported.

Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.

Registry Hives

  • Article
  • 01/07/2021
  • 2 minutes to read

In this article

A hive is a logical group of keys, subkeys, and values in the registry that has a set of supporting files loaded into memory when the operating system is started or a user logs in.

Each time a new user logs on to a computer, a new hive is created for that user with a separate file for the user profile. This is called the user profile hive. A user's hive contains specific registry information pertaining to the user's application settings, desktop, environment, network connections, and printers. User profile hives are located under the HKEY_USERS key.

Registry files have the following two formats: standard and latest. The standard format is the only format supported by Windows 2000. It is also supported by later versions of Windows for backward compatibility. The latest format is supported starting with Windows XP. On versions of Windows that support the latest format, the following hives still use the standard format: HKEY_CURRENT_USER, HKEY_LOCAL_MACHINE\SAM, HKEY_LOCAL_MACHINE\Security, and HKEY_USERS\.DEFAULT; all other hives use the latest format.

Most of the supporting files for the hives are in the %SystemRoot%\System32\Config directory. These files are updated each time a user logs on. The file name extensions of the files in these directories, or in some cases a lack of an extension, indicate the type of data they contain. The following table lists these extensions along with a description of the data in the file.

ExtensionDescription
none
A complete copy of the hive data.
.alt
A backup copy of the critical HKEY_LOCAL_MACHINE\System hive. Only the System key has an .alt file.
.log
A transaction log of changes to the keys and value entries in the hive.
.sav
A backup copy of a hive.
Windows Server 2003 and Windows XP/2000: Copies of the hive files as they looked at the end of the text-mode stage in Setup. Setup has two stages: text mode and graphics mode. The hive is copied to a .sav file after the text-mode stage of setup to protect it from errors that might occur if the graphics-mode stage of setup fails. If setup fails during the graphics-mode stage, only the graphics-mode stage is repeated when the computer is restarted; the .sav file is used to restore the hive data.

The following table lists the standard hives and their supporting files.

Registry hiveSupporting files
HKEY_CURRENT_CONFIG System, System.alt, System.log, System.sav
HKEY_CURRENT_USER Ntuser.dat, Ntuser.dat.log
HKEY_LOCAL_MACHINE\SAM Sam, Sam.log, Sam.sav
HKEY_LOCAL_MACHINE\Security Security, Security.log, Security.sav
HKEY_LOCAL_MACHINE\Software Software, Software.log, Software.sav
HKEY_LOCAL_MACHINE\System System, System.alt, System.log, System.sav
HKEY_USERS\.DEFAULT Default, Default.log, Default.sav

Where are registry hives stored?

Registry hives are located in the Windows\System32\Config folder. That is, for instance, if Windows is installed on drive “C,” you can find Registry hives by navigating to C:\Windows\System32\Config folder.

Which of the main registry hives stores settings which are specific to the currently logged in user?

The HKEY_CURRENT_USER (HKCU) hive contains settings specific to the currently logged in user. The keys in this hive are linked to the related user folder in the HKEY_USERS hive. The HKEY_LOCAL_MACHINE (HKLM) hive contains hardware and software settings specific to the local computer.

What are the Windows registry hives?

A hive is a logical group of keys, subkeys, and values in the registry that has a set of supporting files loaded into memory when the operating system is started or a user logs in. Each time a new user logs on to a computer, a new hive is created for that user with a separate file for the user profile.

What are the primary hives found in the Windows 10 registry?

Here is a list of the common registry hives in Windows:.
HKEY_CLASSES_ROOT..
HKEY_CURRENT_USER..
HKEY_LOCAL_MACHINE..
HKEY_USERS..
HKEY_CURRENT_CONFIG..